CVE-2026-58373
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
A vulnerability in CVAT before version 2.69.0 in the QualityReportViewSet.get_queryset allows authenticated attackers to enumerate quality report identifiers belonging to other organizations. The missing check_object_permissions call on the parent_id parameter in the quality reports API endpoint enables distinguishing existing and non-existing reports via HTTP 500 vs 404 responses.
Risk Assessment
An attacker can disclose the existence of quality reports in other organizations, breaking confidentiality and isolation between organizations. This may lead to further attacks based on the gathered information.
Recommendation
Immediately upgrade CVAT to version 2.69.0 or later, which includes a fix for the missing permission check. If upgrade is not possible, restrict access to the quality reports API for unauthorized users.
Other vulnerabilities in CVAT
See all- CVE-2026-73220High
CVAT, an open source annotation tool, versions 2.68.0 to 2.70.0 contain an XSS vulnerability in the audio annotation guide renderer. A user with guide creation/edit privileges can store malicious JavaScript that executes when another user opens the guide, allowing arbitrary CVAT requests with victim privileges. Fixed in version 2.70.0.
- CVE-2026-73221Medium
CVAT from version 2.17.0 until 2.72.0 has a vulnerability that allows a user with the Worker role to use predictable task-based request IDs with the lambda request retrieve and destroy endpoints to view automatic annotation requests for tasks or jobs the user cannot access and cancel requests initiated by other users. This issue is fixed in version 2.72.0.
- CVE-2026-73219Medium
CVAT is an open source interactive video and image annotation tool. From 2.17.0 until 2.72.0, a user with write access to a CVAT job can submit a batch automatic annotation request with inconsistent task and job IDs, blocking automatic annotation for another task whose ID is known. This issue is fixed in version 2.72.0.
- CVE-2026-65986High
In CVAT versions 2.5.0 through 2.66.0, there is an XSS vulnerability accessible through annotation guide assets. When CVAT serves files attached to an annotation guide, it labels them with a media type that the attacker can influence, allowing the victim's browser to treat the file as an HTML page and run any JavaScript inside it. This issue has been fixed in version 2.67.0.
- CVE-2026-47682High
CVAT versions 1.6.0 through 2.64.0 contain a vulnerability that allows an attacker with write access to a cloud storage added to a CVAT instance, or ability to add new cloud storages, to overwrite arbitrary files on the server's filesystem. This issue has been fixed in version 2.65.0.
Original NVD description (English source)
CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing check_object_permissions call on the parent_id query parameter of the quality reports API endpoint. Attackers can send requests with sequential integer parent_id values and distinguish between existing and non-existing reports via HTTP 500 versus HTTP 404 response differences, disclosing cross-organization report existence without returning report content.